# Frequently asked questions

> Answers about inspect.software — how repositories are inspected, what results mean, free vs. paid coverage, badges, corrections, and independence.


## About the results

### What does the health index actually measure?

Publicly visible practice: commit and release history, contributor
distribution, community files, engineering hygiene, security signals, and
registry state — combined through a
[transparent, versioned methodology](/methodology) into one 1–100 index with
five [rating bands](/wiki/scoring-bands). Full detail per metric is in the
[wiki](/wiki).

### Is a high value a guarantee the software is safe?

No. Results are **signals, not warranties**: no line-by-line audit is
performed, and no methodology can rule out an undiscovered vulnerability.
What a high value does mean is documented precisely in
[signals, not warranties](/wiki/signals-not-warranties).

### Why did a repository's value change without any code changes?

Two legitimate reasons: the observable evidence changed (a release aged past
a threshold, an issue backlog grew), or the methodology version changed —
every formula change is dated and documented in
[methodology versions](/wiki/methodology-versions), and each report records
the version that produced it.

### A metric shows "excluded" components or a null value. Is that a penalty?

The opposite. Data that cannot be observed — no published package, no issue
history — is **excluded and the remaining weights renormalized**, never
counted as zero. The rules are in [the health index](/wiki/health-index).

### Why does organization ownership raise a repository's value?

Organization backing signals shared, accountable stewardship that can
outlive any single maintainer. The lift is deliberate, bounded, and fully
documented in [stewardship](/wiki/stewardship) — one of the few places the
methodology takes an explicit position.

## Submissions and coverage

### How does a repository get into the record?

Any GitHub account may submit a public repository on the [home page](/).
Repositories meeting the documented public-interest thresholds are inspected
free; others can proceed through the paid
[certification route](/pricing) — owners and maintainers can pay from an
account balance directly at submission.

### Which ecosystems are supported?

GitHub repositories in any language, with registry evidence read from npm,
PyPI, Packagist, crates.io, Go, RubyGems, NuGet, and Hex — the full list and
fallback rules are in [supported ecosystems](/wiki/supported-ecosystems).

### Can a private repository be inspected?

Private repository audits are part of the commercial roadmap, but they are not
available through the current self-service product. Contact
[mail@inspect.software](mailto:mail@inspect.software) to
discuss a future engagement.

### Can a repository be removed from the public record?

No. Published results for public repositories stay published. Data errors
are corrected, not removed: see the correction question below.

## Trust and independence

### Can payment improve a result?

No. Payment buys analysis, privacy, and frequency — never a different
number. The methodology and formulas are identical on every tier, and no
commercial relationship can alter a published result. See
[about](/about) for the institutional principles.

### The data about a repository is wrong. How is it corrected?

Flag it through the [contact](/contact) channels with the repository name
and the specific value in question. Confirmed data errors trigger a re-scan;
methodology disagreements are answered with the documented formula — and
sometimes become documented roadmap items.

### Can the results be reproduced independently?

Yes, by design. Every report embeds its inputs, per-component points, scan
configuration, and methodology version; every formula is published. Any
value in the record can be recomputed by hand from the report's own data.

## Badges

### How is a badge added to a README?

Copy the Markdown or HTML snippet from the repository's report page — the
badge updates automatically after every scan. Details on
[the badges page](/badges).

### What does the badge show for an unscanned repository?

A neutral "pending" badge — never a broken image, and never an invented
number.